CVE Catalog
CVE-2026-37007
UnknownSummary
Vulnerability in the FileWriterTool component of crewai-tools <= 1.10.2rc1. A remote attacker can achieve code execution via malicious path traversal sequences in the filename argument.
Risk Assessment
An attacker can write files to arbitrary locations on the server, potentially leading to execution of malicious code and full system compromise.
Recommendation
Update crewai-tools to a patched version. Ensure file paths are properly validated and do not allow traversal outside allowed directories.
Original NVD description (English source)
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.